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al IN THE UNITED STATES DISTRICT COURT 
FOR THE EASTERN DISTRICT OF TENNESSEE 
2 
3 
ECOLAB INC., and NALCO : Case No. 
4 COMPANY, LLC d/b/a NALCO : + 1:22-cv-00050- 
WATER, an Ecolab Company : TRM-SKL 
5 and/or NALCO WATER, : 
6 Plaintiffs 
7 vs 
8 ANTHONY RIDLEY, and 
CHEMTREAT, INC., 
9 
Defendants. 
10 
La 
WEDNESDAY, APRIL 19, 2023 
12 
13 
14 Video Recorded and Remote Zoom Deposition 
1S of LAURENCE LIEB, taken pursuant to Notice, at 
16 the law offices of Fisher & Phillips LLP, 100 
17 North 18th Street, Two Logan Square, 12th 
18 Floor, Philadelphia, Pennsylvania, commencing 
19 at approximately 10:08 a.m., on the above 
20 date, before Rose A. Tamburri, RPR, CM, CCR, 
21 CRR, USCRA Speed and Accuracy Champion and 
22 Notary Public. 
23 
24 VERITEXT LEGAL SOLUTIONS 
Mid-Atlantic Region 
25 1801 Market Street - Suite 1800 
Philadelphia, Pennsylvania 19103 
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il om Are there any cases not listed in 

2 your CV where you've provided some form of 

3 Sworn written testimony, such as an affidavit 
4 or declaration? 

5 A. No. 

6 on Has any judge ever determined that 

7 you were not qualified to testify as an 

8 expert? 

2 A. No. 

iy om Has any judge ever determined that 
11 one of your opinions was unreliable? 

12 A. No. 

13 Q. Has any judge ever precluded you from 
14 testifying, in whole or in part, as to any of 
15 your opinions? 

16 A. No. 

17 om What is your current position? 

18 A. I am the CEO, President and Owner of 
Lg Tyger Forensics, that's Tyger with a Y. 

20 Os And how did you choose the name Tyger 
2 1 Forensics? 
22 A. My father was an English professor, 
23 biblical scholar, and so I am a William Blake 
24 fan. 
25 QO. "Tyger Tyger, burning bright"? 
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1 A. Yes. For a cultured person, yes. 
2 Q. All Pagnts 

3 How many people work for Tyger 
4 Forensics? 

5 A. I have one full-time employee and 
6 then one 1099 employee. 

7 Q. Does Tyger Forensics own any other 
8 businesses? 

2 A. NOs 

10 Q. Do you personally own any other 

La businesses? 

LZ A. NOx 

Is Q. Are you an employee of any other 
14 businesses? 

15 A. I am not. 

16 Q. Are you a consultant for any other 
Ly businesses? 

18 A. I am not. 

19 Q. So what does Tyger Forensics do? 
20 As Tyger Forensics provides computer 
21 forensic services, which involves forensic 
22 preservation and collection of electronic 
23 evidence, generation of forensic databases to 
24 enable analysis of electronic evidence, 
25 forensic analysis of evidence, and then 
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il reporting declarations, testimony, if 
2 required. 
3 0. So you said one of the things that 
4 Tyger Forensics does is the forensic 
5 preservation and collection of electronic 
6 evidence; is that correct? 
7 A. That 16 
8 Q. Can you give me an overview of what 
9 that process involves? 
iu MR. WINSMAN: Objection to form. 
11 THE WITNESS: Certainly. We use 
12 industry standard tools to create forensic 
13 image preservations of Smartphones, laptop, 
14 desktop computers, server data, cloud-based 
15 evidence, social media evidence. 
16 BY MS. LUND: 
17 O« You referenced industry standard 
18 tools. What makes them industry standard? 
19 Aw In my opinion, industry standard 
20 tools are tools that are used in -- widely in 
21 criminal cases and have evidence produced 
22 from those tools have been accepted in 
23 thousands of criminal cases. 
24 Ow Other than the tools, are there other 
25 industry standards that, in your view, apply 
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1 A. Well, over -- over the years, I've 
2 taken many forensic training courses. I 
S typically budget $5,000 a year for myself and 
4 my employees for training. 
5 So I usually take one to two or 
6 more training classes each year, and those 
7 encompass best practices as well. 
8 Q. Is there any particular source or 
cS) reference that you look to in particular for 
U guiding your understanding of industry best 
11 practices? 
12 A. I don't -- can you define "source"? 
13 I don't know what you mean by source. 
14 0. For example, lawyers, we would look 
1,5 to case books; that would be some of our 
16 sources. Or we might look to -- 
17 A. On . 
18 QO. -- you know, the American Law Journal 
19 or something like that. 
20 Is there something similar that 
21 you would look ta as ‘sort of a == a guide or a 
var helpful reference for the industry that you 
23 would look to if you wanted to understand best 
24 practices? 
25 Ais In terms of if -- I don't really 
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1 QO. Okay. 

Z So if we can look at the DLP 

S report. 

4 A. Okay. 

5 Or. And I believe that's already there. 

6 I'm just trying to find the exhibit it was 

7 previously marked as so I can read it into the 
8 record. 

9 Ps That's qoing to. be & Masse -<— 6 2b 2 
U PDF or do you have it as an Excel file? 

11 MR. HOMESLEY: T gan pull iat wp as 
12 a ‘CSV. 

13 THE WITNESS: Oh, okay. 

14 MR. HOMESLEY: So it was 

15 previously entered as Exhibit 27. 

16 THE WITNESS: I don't know if 

17 there is Excel on this machine because it 

18 really =-= that’s == that"s what -> Excel is 

aie what opens up CSV files for them to be 

20 readable. T'll wait to -- maybe -- maybe 

21 there's Excel on -- I'll see if there's Excel 
var on this machine. Maybe there is. I aoubt. 20. 
23 No. I see an Excel -- oh, there is Excel on 
24 here. Okay. 
25 MR. HOMESLEY: ALL. right. It 


Veritext Legal Solutions 


Case 1:22-cv-000502#RMESHK POD Lire SaR8a Wieei/bd)219732BR BAS PagelD #: 


9955 


Page 169 

1 should be up there as Exhibit 27. 

2 THE WITNESS: Okay. 

S MR. HOMESLEY: You'll have to 

4 download it. 

5 THE WITNESS: Okay. There we go. 
6 Yeah, I’m going to have to -= 

7 there's -- I'm going to have to download this 
8 because there's no way to -- 

2 MS. LUND: Yes. 

10 THE WITNESS: There's no way to -- 
11 it has to be done with Excel. 

12 (Brief pause.) 

13 THE WITNESS: It's a large file. 
14 Okay. Hopefully this version of Excel is 

1.5 registered. 

16 Okay. 

17 MS. LUND: Okay. 

18 BY MS. LUND: 

19 O« So if you could go ahead -- 
20 Aus Create and edit files. Okay. Tt a 
21 use -- do you want me -- sorry. 
22 Q. No, that's okay. 
23 If you could go ahead and share 
24 your screen so that we can all be seeing what 
25 you're looking at. 
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i A. Well, I -- I am sharing. You're not 
2 -- you're not seeing this? 

S MR. HOMESLEY: Yep. 

4 THE WITNESS: It's just -- the ver 
5 -- this doesn't have Excel on it. 

6 MS. LUND: Okay. Yep. Great. 

7 BY MS. LUND: 

8 Q. And then if you could go to the 

9 Operation Type column. 

U A. Okay. ie 106 == be 20 Okay 2E ft de 
11 what I norm -- what I described in my 

12 analysis? 

13 QO. Yes, go ahead. 

14 Pus Because it's going to make this -- 
15 om Yes. 

16 A. -- infinitely easier for everyone 

17 involved. 

18 So == s0 I @o tp to view —=— 22 2E 
19 allows -- it's not letting me do it because 
20 I -- crap. 
21 So normally I go to freeze pane 
22 and freeze top row, because there's not a -- 
23 this is not a -- a registered version of -- 
24 let me see if I can do it. It says "Use free 
25 at office.com. Let's see if it allows me to 


Veritext Legal Solutions 


Case 1:22-cv-000502#RMESK POD oe LrEtt SaRsa Wier/dd/2 19732 BR ESE IA5 PagelD #: 


yes 


Page 171 

1 ao, 1%. 

2 MS. LUND: You know what, let's go 
S ahead and go off the record. 

4 THE VIDEOGRAPHER: The time is now 
5 27209. Going off the video record. 

6 (Brief pause.) 

7 THE VIDEOGRAPHER: The time is now 
8 2313s Back on the video record. 

9 BY MS. LUND: 

10 O's ALL PLGae « 

11 Mr. Lieb, before we took a break 
12 to work out our technical issues, you were 

Lo telling us the -- what you did with the 

14 Digital Guardian report to make it workable 

1.5 and you were going to walk us through that 

16 report which is now up on the screen. 

17 Can you go ahead, please. 

18 A. Absolutely. 

19 So this is -- I'm replicating what 
va) my forensic analysis steps were. 

21 So I == first I haghlighted the —= 
22 the top row, which is column headers. I go to 
23 view, freeze pane, freeze top row. So that 
24 allows me to then scroll with the top -- the 
25 top row just remaining. 
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1 add to that in terms of your forensic 

2 analysis? 

3 A. No. 

4 Q. Okay. 

5 And then you say you came to the 
6 forensic observations and opinions set forth 
7 in this report; correct? 

8 A. Correct. 

9 Os And your opinion, as set. forth rn 

U paragraph 14, is that the Digital Guardian 

11 report captured and recorded an extensive 

12 amount of files being exfiltrated by Ridley 
13 usang his former Ecolab laptop, and that’s 

14 your opinion? 

1.5 A. It 18% 

16 Oi. Okay. 

17 And what do you mean when you say 
18 "exfiltrated"? 

alee A. It's a -- a forensic term meaning 

20 taken up -- copied to an external USB drive 
21 that a former employee will take with them to 
22 use in their own company that they establish, 
23 or a competitor, sent to -- documents that are 
24 sent -- any document activity copying, moving 
25 to -- from a company-owned device or account 
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Hl A. Well, I believe "misappropriated" may 
Z be a legal term of art, so I -- I believe 

3 it's my opinion that he took those files to 

4 use them to compete against his former 

5 employer. 

6 Q. Okay. 

7 Let's look at your opinion in your 
8 report at paragraph 14. 

9 Avs Okay. 

10 On And you'll see the second sentence of 
11 paragraph 14, you say, "From a forensic 

12 analysis standpoint, the Digital Guardian 

Lo Report provides more than sufficient amount of 
14 information for me to arrive at my conclusion 
1.5 that Ridley misappropriated thousands of 

16 Ecolab files." 

17 Is that still your opinion? 

18 Bis It 18. 

19 O'. Okay. 

va) Even though misappropriated, you 
2 just testified, is actually a legal term? 

22 A. It could be a legal term. In my -- 
23 in plain English, it*s there. 
24 Q. Okay. 
25 And so it's your opinion, based on 
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Hl thousands of Nalco-related files. 
2 QO. So if I can have you answer my 
3 question, which is what objective standard do 
4 you use to determine whether the transfer of 
5 files from one company-issued device to 
6 another company-issued device is exfiltration 
7 or theft and when it's not? 
8 A. I don't know what you mean by 
9 "objective standard." 
10 QO. Okay. 
11 Well, as we discussed this 
12 morning, you have testified that everything 
13 you do is, quote, 100 percent based upon 
14 science and can 100 percent be replicated by a 
1.5 qualified peer. 
16 A. Ves: 
17 on And I'm asking you what objective 
18 standard can a qualified peer apply to reach 
19 the same conclusion you did that this was 
20 theft as opposed to ordinary course of 
ae k business? 
22 A. Well, it would be the timing that the 
23 activity occurred, the business circumstances 
24 under which it occurred, a knowledge of an 
25 employee having already accepted or looking 
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il for another work -- another job, the volume 
2 and -- the volume and amount and frequency by 
3 which the data was stolen, and then 
4 subsequent -- you know, Jim -- Jim Vaughn's 
5 report confirmed my findings. 
6 so. 1 == I'm vindicated. 
7 O's Okay. 
8 What -- what, in particular, do 
9 you believe that Mr. Vaughn's report confirmed 
iu with regard to your findings? 
11 A. The CrowdStrike report showed Mr. 
12 Ridley interacting with some of the 
i exfiltrated files using his ChemTreat laptop. 
14 Q. Were -- 
15 A. So he took them to use while working 
16 at ChemTreat. 
17 OW Se that's a conclusion you" ve drawn, 
18 A. No, that's what the CrowdStrike 
aie report shows. 
20 Q. The CrowdStrike report shows the 
2 LaCie drive being plugged into ChemTreat's 
22 laptop? 
23 A. It shows Ridley interacting with 
24 Nalco Water files while using his now wiped 
25 ChemTreat laptop. 
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1 That is my expert opinion. 

2 oe Right. 

3 And my question to you is, you are 

4 offering an opinion about Mr. Ridley's intent 

5 that he did something specifically for a 

6 purpose to utilize them while employed at 

7 ChemTreat. 

8 That is your opinion; correct? 

2 A. Which he -- which he -- which he did. 
10 QO. I understand that's your opinion, Mr. 
11 Lieb. 

12 I'm asking you, what is -- 

i Ps No, that"*s not. opinion. That's what 
14 shows in the CrowdStrike report and what I've 
1.5 been informed that he admitted to on -- doing 
16 on less tour -—- less than four no -- no Less 
dae than four occasions in his deposition 

18 yesterday. 

19 om Mr. Lieb, it's important that we not 
20 talk over each other, so please do not 

2 interrupt me when I'm asking you a question 
22 and then you can answer my question. 

23 Okay? 

24 A. Okay. 

25 Q. Great. All Pight, 
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